SAN FRANCISCO, April 17, 2018 – Back in 1995, I first started researching the lives and friends of Kevin Mitnick as an author’s assistant for what would turn out to be a best-selling book. Although I wondered what I was getting myself into, I wanted to know who these cyber hackers were, why they broke into systems, and more importantly, I wanted to learn from them.

This need to understand your enemy in cyberspace has become abundantly clear again at the RSA Security Conference this year (Some 23 years later if I’ve done the math right).

During Monday’s pre-show activities, two companies in particular revealed chilling research uncovered during their security and investigative operations and data collection.

Let’s start with the value attributed to cybercrime and crimeware. At an analyst dinner sponsored by Bromium (the book’s publisher), Dr. Michael McGuire, senior lecturer, University of Surrey estimated the market is easily worth $1.5 trillion, based on interviews with convicted cyber criminals.

“That’s the GDP of a mid-sized country,” he says. “And that’s a very conservative estimate.”

Cybercrime-as-a-service platform managers can earn up to $2 million a year, individual high-earners make up to $166,000 a month, and middle-earners make a mere $75,000 a month, according to his calculations.

Makes you wonder if we (the good guys) are working for the wrong side. But then consider the “dark side” of criminal endeavors involving this much money: kidnapping, coercion, jail time, even murder accompany criminal enterprises of this value. The funds are even being used to fund terrorism in an economy that is so strong it could break the financial system if it were to be brought down, Dr. McGuire conjectures.

Lately, specific cyber crime activity has been shifting away from ransomware and damage-based attacks to accessing stolen computing power to mine bitcoins, according to another equally-compelling report unveiled by Comodo’s Threat Research Labs earlier in the evening. Back door attacks, which are needed to continue to access the hijacked computer for its bitcoin computing power, are also spiking upwards, according to the report.

The report results, delivered by Comodo senior scientist Kenneth Gears, also shows that greed is not the only motivation behind cyber attacks. On a large display screen, Gears pointed out distinct hikes in regional cyber attacks in South America, Mexico, Canada, the Koreas and Iran (among other countries) during times of political turmoil.

Gears adds “Cyberspace reflects human activity, whether it be an election or conflict.”

SAN FRANCISCO, FEB 16 2017 – Imagine billions of sand-sized computing devices tossed into municipal waste, still alive by battery and calling out to one another. Imagine them joining a billions-strong botnet stretched out across the land sending short signals to deny service and pass along small bytes of malware to anything within proximity.

Think this is something from the future? Think again.

Late last year, smart things such as cameras were conscripted into botnets under the Marai Malware family, disrupting more than 900,000 Deutsch Telecom users, as well as 2,400 routers in England, and continues to morph and prey on new vulnerabilities found in other types of smart devices.

Meanwhile, smart dust or MEMS – Micro Electric Mechanical Systems – in the form of used RFID packaging, micro sensors (the size of salt grains) and other smart waste are already being tossed into dumps without end-of-life kill processes or even a means to turn them off, says Michael Patterson, CEO of Plixer, during the RSA Security Conference exhibition.

“These are purpose-built smart devices with unique protocols, communications to their servers, and access to their administrative community,” he says. “Without governance and oversight – like Underwriter Laboratories that we have for other electrical devices – these miniature smart chips have the potential to become a real risk to cyber security.”

So concerning are these smart devices that Adi Shamir (who’s last name represents the ‘S’ in RSA encryption technology) will soon release a paper he titled “IOT Going Nuclear.” In it, he says he demonstrates how someone could sit in a hotel room, plug one infected smart light into a socket, and then spread malware from one smart light to others.

Based on density of the smart light fixtures, you could infect a whole city in minutes, turn off all the lights and hold the city ransom until the city pays to have the lights turned on, continues Shamir, a professor of computer science at the Weizmann Institute in Israel.

Ransomware holdups have already happened with other smart devices, for example in late 2016, LG television systems were hijacked by ransomware and turned into bricks until TV owners ponied up money to get them working again.

“The government should NOT allow devices that are not sufficiently secure to connect to the public internet,“ Ramir says, which drew loud applause from the crowd attending the RSA cryptographer’s panel keynote session on Tuesday.

Whitfield Diffie, co-inventor of the Diffie Hellman Key exchange back in the 70’s (who was also on the panel), says that throwing more layers of security on top of this problem is not the answer. Instead, he urges everyone to reset their strategies and improve their products with secure engineering and software coding in the first place.

“If anything like the resources being spent on interactive security – virus screening, fighting back, et cetera – were spent on the improvement on the logical functions of devices, we’d get much much better results,” says Diffie, currently a crypto export with Cryptomathic.

Will anybody heed such sage advice? Engineering and development have historically focused on ‘go-to-market’ first. Security, if considered at all, is usually an afterthought or the result of their products being hacked. This is why we’re in this mess in the first place!